CWE-312 · Cleartext Storage of Sensitive Information (page 6)
Page 6 of 9 — CVEs classified under CWE-312, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-35279 | Medium | 4.3 | 2022-11-03 | "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, and 22.0.1 could disclose sen… |
CVE-2022-34339 | Medium | 6.5 | 2022-11-03 | "IBM Cognos Analytics 11.2.1, 11.2.0, 11.1.7 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 229963." |
CVE-2021-39077 | Medium | 4.4 | 2022-11-03 | IBM Security Guardium 10.5, 10.6, 11.0, 11.1, 11.2, 11.3, and 11.4 stores user credentials in plain clear text which can be read by a local privileged user. IB… |
CVE-2022-39364 | Medium | 4.0 | 2022-10-27 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. In Nextcloud Server prior to versions 23.0.9 and 24.0.5 and Ne… |
CVE-2022-39351 | Medium | 4.4 | 2022-10-25 | Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, p… |
CVE-2022-2805 | Medium | 6.5 | 2022-10-19 | A flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-style. This flaw allows an attacker with s… |
CVE-2022-3540 | Medium | 6.5 | 2022-10-17 | An issue has been discovered in hunter2 affecting all versions before 2.1.0. Improper handling of auto-completion input allows an authenticated attacker to ext… |
CVE-2022-33918 | Medium | 5.5 | 2022-10-12 | Dell GeoDrive, Versions 2.1 - 2.2, contains an information disclosure vulnerability. An authenticated non-admin user could potentially exploit this vulnerabili… |
CVE-2020-15332 | Critical | 9.8 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/etc/default/axess permissions. |
CVE-2020-15325 | Medium | 5.3 | 2022-09-29 | Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has a hardcoded Erlang cookie for ejabberd replication. |
CVE-2015-1931 | Medium | 5.5 | 2022-09-29 | IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR1 FP10, 7 R1 before SR3 FP10, 7 before SR9 FP10, 6 R1 before SR8 FP7, 6 before SR16… |
CVE-2022-32217 | Medium | 5.3 | 2022-09-23 | A cleartext storage of sensitive information exists in Rocket.Chat <v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs. |
CVE-2022-41248 | Medium | 5.3 | 2022-09-21 | Jenkins BigPanda Notifier Plugin 1.4.0 and earlier does not mask the BigPanda API key on the global configuration form, increasing the potential for attackers… |
CVE-2022-26390 | Medium | 4.2 | 2022-09-09 | The Baxter Spectrum Wireless Battery Module (WBM) stores network credentials and PHI (only applicable to Spectrum IQ pumps using auto programming) in unencrypt… |
CVE-2022-37857 | High | 7.5 | 2022-09-08 | bilde2910 Hauk v1.6.1 requires a hardcoded password which by default is blank. This hardcoded password is hashed but stored within the config.php file server-s… |
CVE-2021-36782 | Critical | 9.9 | 2022-09-07 | A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows authenticated Cluster Owners, Cluster Members, Project Owners, Project Member… |
CVE-2022-22069 | High | 7.7 | 2022-09-02 | Devices with keyprotect off may store unencrypted keybox in RPMB and cause cryptographic issue in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… |
CVE-2022-2739 | Medium | 5.3 | 2022-09-01 | The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for… |
CVE-2021-39009 | Medium | 5.5 | 2022-09-01 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 21355… |
CVE-2021-3585 | Medium | 5.5 | 2022-08-26 | A flaw was found in openstack-tripleo-heat-templates. Plain passwords from RHSM exist in the logs during OSP13 deployment with subscription-manager. |
CVE-2022-2569 | Medium | 5.5 | 2022-08-24 | The affected device stores sensitive information in cleartext, which may allow an authenticated user to access session data stored in the OAuth database belong… |
CVE-2022-2813 | Medium | 4.3 | 2022-08-15 | A vulnerability, which was classified as problematic, was found in SourceCodester Guest Management System. Affected is an unknown function. The manipulation le… |
CVE-2022-33928 | Medium | 6.4 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains an Plain-text Password Storage Vulnerability in UI. An attacker with low privileges could potentially explo… |
CVE-2022-29090 | High | 8.5 | 2022-08-10 | Dell Wyse Management Suite 3.6.1 and below contains a Sensitive Data Exposure vulnerability. A low privileged malicious user could potentially exploit this vul… |
CVE-2022-34924 | High | 7.5 | 2022-08-02 | Lanling OA Landray Office Automation (OA) internal patch number #133383/#137780 contains an arbitrary file read vulnerability via the component /sys/ui/extend/… |
CVE-2022-31205 | High | 7.5 | 2022-07-26 | In Omron CS series, CJ series, and CP series PLCs through 2022-05-18, the password for access to the Web UI is stored in memory area D1449...D1452 and can be r… |
CVE-2022-30275 | High | 7.5 | 2022-07-26 | The Motorola MOSCAD Toolbox software through 2022-05-02 relies on a cleartext password. It utilizes an MDLC driver to communicate with MOSCAD/ACE RTUs for engi… |
CVE-2022-24660 | High | 7.5 | 2022-07-20 | The debug interface of Goldshell ASIC Miners v2.2.1 and below was discovered to be exposed publicly on the web interface, allowing attackers to access password… |
CVE-2022-30626 | Medium | 6.3 | 2022-07-18 | Browsing the path: http://ip/wifi_ap_pata_get.cmd, will show in the name of the existing access point on the component, and a password in clear text. |
CVE-2022-20219 | Medium | 5.5 | 2022-07-13 | In multiple functions of StorageManagerService.java and UserManagerService.java, there is a possible way to leave user's directories unencrypted due to a logic… |
CVE-2022-22031 | High | 7.8 | 2022-07-12 | Windows Credential Guard Domain-joined Public Key Elevation of Privilege Vulnerability |
CVE-2022-27549 | Medium | 4.0 | 2022-07-06 | HCL Launch may store certain data for recurring activities in a plain text format. |
CVE-2022-22367 | Medium | 5.5 | 2022-07-01 | IBM UrbanCode Deploy (UCD) 6.2.7.15, 7.0.5.10, 7.1.2.6, and 7.2.2.1 could disclose sensitive database information to a local user in plain text. IBM X-Force ID… |
CVE-2022-22366 | Medium | 4.4 | 2022-07-01 | IBM UrbanCode Deploy (UCD) 6.2.7.15, 7.0.5.10, 7.1.2.6, and 7.2.2.1 stores user credentials in plain clear text which can be read by a local user. IBM X-Force… |
CVE-2022-22478 | Medium | 5.5 | 2022-06-30 | IBM Spectrum Protect Client 8.1.0.0 through 8.1.14.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 225886. |
CVE-2021-41639 | Medium | 5.5 | 2022-06-24 | MELAG FTP Server 2.2.0.4 stores unencrpyted passwords of FTP users in a local configuration file. |
CVE-2021-45025 | High | 7.5 | 2022-06-17 | ASG technologies ( A Rocket Software Company) ASG-Zena Cross Platform Server Enterprise Edition 4.2.1 is vulnerable to Cleartext Storage of Sensitive Informati… |
CVE-2017-20040 | Medium | 5.9 | 2022-06-11 | A vulnerability was found in SICUNET Access Controller 0.32-05z. It has been declared as problematic. This vulnerability affects unknown code of the component… |
CVE-2022-29620 | Medium | 6.5 | 2022-06-07 | FileZilla v3.59.0 allows attackers to obtain cleartext passwords of connected SSH or FTP servers via a memory dump.- NOTE: the vendor does not consider this a… |
CVE-2022-31004 | High | 7.5 | 2022-06-02 | CVEProject/cve-services is an open source project used to operate the CVE services API. A conditional in 'data.js' has potential for production secrets to be w… |
CVE-2022-23236 | Medium | 4.4 | 2022-06-02 | E-Series SANtricity OS Controller Software versions 11.40 through 11.70.2 store the LDAP BIND password in plaintext within a file accessible only to privileged… |
CVE-2022-22484 | Medium | 5.5 | 2022-05-17 | IBM Spectrum Protect Operations Center 8.1.12 and 8.1.13 could allow a local attacker to obtain sensitive information, caused by plain text user account passwo… |
CVE-2022-28214 | High | 7.8 | 2022-05-11 | During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon… |
CVE-2022-29868 | Medium | 5.5 | 2022-05-09 | 1Password for Mac 7.2.4 through 7.9.x before 7.9.3 is vulnerable to a process validation bypass. Malicious software running on the same computer can exfiltrate… |
CVE-2022-28162 | Low | 3.3 | 2022-05-09 | Brocade SANnav before version SANnav 2.2.0 logs the REST API Authentication token in plain text. |
CVE-2021-39078 | Medium | 4.4 | 2022-04-19 | IBM Security Guardium 10.5 stores user credentials in plain clear text which can be read by a local privileged user. IBM X-Force ID: 215589. |
CVE-2022-0835 | High | 8.1 | 2022-04-11 | AVEVA System Platform 2020 stores sensitive information in cleartext, which may allow access to an attacker or a low-privileged user. |
CVE-2022-25160 | Medium | 5.9 | 2022-04-01 | Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electric MELSEC iQ-F se… |
CVE-2022-25158 | Critical | 9.1 | 2022-04-01 | Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electric MELSEC iQ-F se… |
CVE-2021-45491 | Medium | 6.5 | 2022-03-28 | 3CX System through 2022-03-17 stores cleartext passwords in a database. |
CVE-2022-26148 | Critical | 9.8 | 2022-03-21 | An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When t… |
CVE-2022-23234 | Medium | 5.5 | 2022-03-16 | SnapCenter versions prior to 4.5 are susceptible to a vulnerability which could allow a local authenticated attacker to discover plaintext HANA credentials. |
CVE-2022-26778 | Medium | 5.3 | 2022-03-10 | Veritas System Recovery (VSR) 18 and 21 stores a network destination password in the Windows registry during configuration of the backup configuration. This co… |
CVE-2021-43590 | Medium | 6.0 | 2022-03-04 | Dell EMC Enterprise Storage Analytics for vRealize Operations, versions 4.0.1 to 6.2.1, contain a Plain-text password storage vulnerability. A local high privi… |
CVE-2021-27757 | High | 7.5 | 2022-03-04 | " Insecure password storage issue.The application stores sensitive information in cleartext within a resource that might be accessible to another control spher… |
CVE-2021-35036 | Medium | 6.5 | 2022-03-01 | A cleartext storage of information vulnerability in the Zyxel VMG3625-T50B firmware version V5.50(ABTL.0)b2k could allow an authenticated attacker to obtain se… |
CVE-2020-14480 | Medium | 5.5 | 2022-02-24 | Due to usernames/passwords being stored in plaintext in Random Access Memory (RAM), a local, authenticated attacker could gain access to certain credentials, i… |
CVE-2021-3551 | High | 7.8 | 2022-02-16 | A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allow… |
CVE-2022-21818 | Medium | 5.4 | 2022-02-15 | NVIDIA License System contains a vulnerability in the installation scripts for the DLS virtual appliance, where a user on a network after signing in to the por… |
CVE-2021-40363 | High | 7.8 | 2022-02-09 | A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1), SIMA… |
CVE-2021-42642 | High | 7.5 | 2022-02-02 | PrinterLogic Web Stack versions 19.1.1.13 SP9 and below are vulnerable to an Insecure Direct Object Reference (IDOR) vulnerability that allows an unauthenticat… |
CVE-2022-22789 | Medium | 6.1 | 2022-01-25 | Charactell - FormStorm Enterprise Account takeover – An attacker can modify (add, remove and update) passwords file for all the users. The xx_users.ini file in… |
CVE-2022-23129 | Medium | 5.5 | 2022-01-21 | Plaintext Storage of a Password vulnerability in Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior and ICONICS GENESIS64 versions 10.90 to… |
CVE-2021-31821 | Medium | 5.5 | 2022-01-19 | When the Windows Tentacle docker image starts up it logs all the commands that it runs along with the arguments, which writes the Octopus Server API key in pla… |
CVE-2022-20660 | Medium | 4.6 | 2022-01-14 | A vulnerability in the information storage architecture of several Cisco IP Phone models could allow an unauthenticated, physical attacker to obtain confidenti… |
CVE-2021-45077 | High | 7.5 | 2021-12-30 | Netgear Nighthawk R6700 version 1.0.4.120 stores sensitive information in plaintext. All usernames and passwords for the device's associated services are store… |
CVE-2021-20171 | Medium | 5.5 | 2021-12-30 | Netgear RAX43 version 1.0.3.96 stores sensitive information in plaintext. All usernames and passwords for the device's associated services are stored in plaint… |
CVE-2021-20162 | Medium | 4.9 | 2021-12-30 | Trendnet AC2600 TEW-827DRU version 2.08B01 stores credentials in plaintext. Usernames and passwords are stored in plaintext in the config files on the device… |
CVE-2021-35035 | Medium | 4.9 | 2021-12-29 | A cleartext storage of sensitive information vulnerability in the Zyxel NBG6604 firmware could allow a remote, authenticated attacker to obtain sensitive infor… |
CVE-2021-20827 | High | 7.5 | 2021-12-24 | Plaintext storage of a password vulnerability in IDEC PLCs (FC6A Series MICROSmart All-in-One CPU module v2.32 and earlier, FC6A Series MICROSmart Plus CPU mod… |
CVE-2021-43388 | High | 7.5 | 2021-12-14 | Unisys Cargo Mobile Application before 1.2.29 uses cleartext to store sensitive information, which might be revealed in a backup. The issue is addressed by ens… |
CVE-2021-42066 | Medium | 4.4 | 2021-12-14 | SAP Business One - version 10.0, allows an admin user to view DB password in plain text over the network, which should otherwise be encrypted. For an attacker… |
CVE-2021-41090 | Medium | 6.5 | 2021-12-08 | Grafana Agent is a telemetry collector for sending metrics, logs, and trace data to the opinionated Grafana observability stack. Prior to versions 0.20.1 and 0… |
CVE-2021-34544 | Medium | 6.5 | 2021-12-07 | An issue was discovered in Solar-Log 500 before 2.8.2 Build 52 23.04.2013. In /export.html, email.html, and sms.html, cleartext passwords are stored. This may… |
CVE-2021-38949 | Medium | 5.5 | 2021-11-16 | IBM MQ 7.5, 8.0, 9.0 LTS, 9.1 CD, and 9.1 LTS stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 211403. |
CVE-2021-37157 | High | 8.8 | 2021-11-10 | An issue was discovered in OpenGamePanel OGP-Agent-Linux through 2021-08-14. $HOME/OGP/Cfg/Config.pm has the root password in cleartext. |
CVE-2020-10053 | Medium | 5.5 | 2021-11-09 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.12). The affected application writes sensitive data, such as database c… |
CVE-2021-42370 | High | 7.5 | 2021-11-08 | A password mismanagement situation exists in XoruX LPAR2RRD and STOR2RRD before 7.30 because cleartext information is present in HTML password input fields in… |
CVE-2021-25502 | High | 7.9 | 2021-11-05 | A vulnerability of storing sensitive information insecurely in Property Settings prior to SMR Nov-2021 Release 1 allows attackers to read ESN value without pri… |
CVE-2021-38422 | High | 7.8 | 2021-11-03 | Delta Electronics DIALink versions 1.2.4.0 and prior stores sensitive information in cleartext, which may allow an attacker to have extensive access to the app… |
CVE-2020-15935 | Medium | 4.3 | 2021-11-02 | A cleartext storage of sensitive information in GUI in FortiADC versions 5.4.3 and below, 6.0.0 and below may allow a remote authenticated attacker to retrieve… |
CVE-2021-42763 | High | 7.5 | 2021-11-02 | Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Sensitive Information in Cleartext. The issue occurs when the cluster manager forwards a HTTP request… |
CVE-2021-37842 | High | 7.5 | 2021-11-02 | metakv in Couchbase Server 7.0.0 uses Cleartext for Storage of Sensitive Information. Remote Cluster XDCR credentials can get leaked in debug logs. Config key… |
CVE-2021-29786 | Medium | 6.5 | 2021-10-27 | IBM Jazz Team Server products stores user credentials in clear text which can be read by an authenticated user. IBM X-Force ID: 203172. |
CVE-2021-40527 | High | 8.6 | 2021-10-25 | Exposure of senstive information to an unauthorised actor in the "com.onepeloton.erlich" mobile application up to and including version 1.7.22 allows a remote… |
CVE-2021-38911 | Medium | 4.9 | 2021-10-19 | IBM Security Risk Manager on CP4S 1.7.0.0 stores user credentials in plain clear text which can be read by a an authenticatedl privileged user. IBM X-Force ID… |
CVE-2021-40454 | Medium | 5.5 | 2021-10-13 | Rich Text Edit Control Information Disclosure Vulnerability |
CVE-2021-38915 | Medium | 6.5 | 2021-10-12 | IBM Data Risk Manager 2.0.6 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 209947. |
CVE-2021-41302 | High | 7.3 | 2021-09-30 | ECOA BAS controller stores sensitive data (backup exports) in clear-text, thus the unauthenticated attacker can remotely query user password and obtain user’s… |
CVE-2021-36165 | Medium | 5.3 | 2021-09-28 | RICON Industrial Cellular Router S9922L 16.10.3(3794) is affected by cleartext storage of sensitive information and sends username and password as base64. |
CVE-2021-29904 | Medium | 5.5 | 2021-09-23 | IBM Jazz for Service Management 1.1.3.10 and IBM Tivoli Netcool/OMNIbus_GUI displays user credentials in plain clear text which can be read by a local user. IB… |
CVE-2021-38150 | Medium | 6.5 | 2021-09-14 | When an attacker manages to get access to the local memory, or the memory dump of a victim, for example by a social engineering attack, SAP Business Client ver… |
CVE-2021-33716 | Medium | 6.5 | 2021-09-14 | A vulnerability has been identified in SIMATIC CP 1543-1 (incl. SIPLUS variants) (All versions < V3.0), SIMATIC CP 1545-1 (All versions < V1.1). An attacker wi… |
CVE-2020-19137 | High | 7.5 | 2021-09-08 | Incorrect Access Control in Autumn v1.0.4 and earlier allows remote attackers to obtain clear-text login credentials via the component "autumn-cms/user/getAllU… |
CVE-2021-35526 | Medium | 6.3 | 2021-09-08 | Backup file without encryption vulnerability is found in Hitachi ABB Power Grids System Data Manager – SDM600 allows attacker to gain access to sensitive infor… |
CVE-2021-1865 | Medium | 5.0 | 2021-09-08 | An issue obscuring passwords in screenshots was addressed with improved logic. This issue is fixed in iOS 14.5 and iPadOS 14.5. A user's password may be visibl… |
CVE-2021-36096 | Medium | 5.2 | 2021-09-06 | Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG ((OTRS)) Community Edition 6.0.x… |
CVE-2021-22929 | Medium | 6.1 | 2021-08-31 | An information disclosure exists in Brave Browser Desktop prior to version 1.28.62, where logged warning messages that included timestamps of connections to V2… |
CVE-2021-31989 | Medium | 5.3 | 2021-08-25 | A user with permission to log on to the machine hosting the AXIS Device Manager client could under certain conditions extract a memory dump from the built-in W… |
CVE-2021-40087 | Low | 2.7 | 2021-08-25 | An issue was discovered in PrimeKey EJBCA before 7.6.0. When audit logging changes to the alias configurations of various protocols that use an enrollment secr… |